A Last Revealer Attack is a biasing tactic in a commit reveal randomness scheme where the final participant decides whether to reveal a secret after seeing the possible outcome. By withholding or publishing the reveal, the participant can influence the final random value. This weakens fairness in consensus selection.
How the last revealer changes a commit reveal scheme
The last revealer is the participant who can still decide whether the randomness output should be finalised after seeing the partial information already on chain or in the protocol. That final choice creates a biasing opportunity: if the outcome looks unfavourable, the participant can withhold the reveal and force the scheme to abort, delay, or fall back to a different process.
This is not a flaw in the idea of commit reveal itself, it is a failure mode in the final step where liveness and fairness collide. The more a scheme depends on a single last reveal to complete the entropy pool, the more power that participant has to skew the result. That is why commit reveal designs are often discussed alongside penalties, multi-party threshold approaches, or other anti-bias controls rather than as a standalone fairness guarantee.
Why it matters for fairness and consensus selection
A last revealer attack is most damaging when the random value is used to select validators, leaders, committee members, or any other actor with execution authority. In those settings, a small bias in the output can change who gets chosen, which can then affect consensus integrity, censorship resistance, and the perceived neutrality of the system.
The weakness is structural, not just malicious. Even an honest participant may rationally choose not to reveal if the revealed value is disadvantageous to them, especially when there is no cost to aborting. That makes the scheme sensitive to strategic behaviour in exactly the way fairness-sensitive protocols want to avoid.
Where the control breaks down
The control breaks down when the protocol lets a participant inspect enough of the intermediate state to infer whether revealing will help or hurt them. At that point, the reveal is no longer a neutral contribution to entropy, it becomes an option the participant can exercise selectively.
Systems that rely on a single final reveal are especially exposed. A stronger design either removes the ability to veto the outcome, makes withholding costly, or ensures that no single participant can determine the final randomness on their own. The issue is less about secrecy and more about preventing one actor from turning uncertainty into leverage.
Risk and Threat Considerations
The main risk is outcome manipulation in any protocol that uses the random value to assign high-value roles or resources. If the final revealer can see that disclosure would worsen their position, they may abort or delay the reveal, weakening fairness and potentially creating a denial-of-service effect on the randomness process.
Failure mechanism: the protocol gives the last participant unilateral influence over completion, so they can choose between publishing a reveal that finalises the value or withholding it to avoid an unfavourable result.
Impact: the final randomness becomes biasable, consensus selection can be skewed, and any downstream decision that depends on impartial randomness inherits that manipulation risk.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS Control 6 — Access Control Management | Biasable randomness can alter authority assignment and access decisions in consensus workflows. |
| Recommendation — Restrict role assignment paths so one participant cannot unilaterally skew selection outcomes. | ||
| NIST CSF 2.0 | PR.AC — Access Control | Fair randomness governs who receives system authority, so access outcomes depend on trustworthy selection. |
| GV.RM — Risk Management Strategy | The attack is a governance risk because it weakens fairness assumptions in selection mechanisms. | |
| Recommendation — Apply access control principles to prevent single-party influence over authority allocation. Document the bias risk and require controls that limit strategic abort behavior. | ||
| MITRE ATT&CK | T1029 — Scheduled Transfer | Withholding or releasing at a chosen time is a timing-dependent abuse of protocol sequencing. |
| Recommendation — Model reveal timing abuse as adversary-controlled sequencing and detect strategic withholding. | ||
Practitioner Guidance
Why practitioners should care: any randomness process that can be strategically aborted is not fully fair, even if it is cryptographically sound. If the outcome affects validator selection, lotteries, sharding, leader election, or other security-sensitive assignments, that bias can become an access and control problem rather than a purely theoretical weakness.
Common misunderstanding: committing first does not by itself guarantee fairness at the end of the protocol. The final reveal step needs its own anti-bias assumptions, because the last party still controls whether the randomness is actually released.
Practitioner takeaway: treat the last reveal as a governance and liveness risk, not just a cryptographic detail, and prefer designs that reduce single-party veto power over the final output.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 20, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
